AdminConsole
Stateful journeys/AI & Location
statefulvision evidence case aggregate
SkyDNN AI · synchronous inference, durable evidence

Governed SkyDNN inference review

Lock an entitled model to an immutable asset identity, call the documented synchronous prediction boundary, validate geometry and confidence, require independent review, and redact derived detections on schedule.

Open implementation workshop Run verified appExplore lifecycle
Lifecycle state machine

Every state means something operational

A state is not a UI label. It determines which actor may act, what evidence exists, what may be retried, and how recovery proceeds.

01
registered

Registered

The application owns a purpose-bound case with opaque asset identity, SHA-256 content hash, media facts, capture time, location context, lawful-basis reference, and retention deadline.

02
model_locked

Model locked

An entitled server-discovery result and one exact API model key, fingerprint, class vocabulary, and policy version are frozen for the case.

03
inference_requested

Inference requested

One worker owns an idempotent synchronous provider-call attempt against the exact asset and model identities.

04
inferred

Inferred

A schema-valid provider response has normalized labels, confidence, bounded geometry, timing, provenance, and response hash without becoming a business decision.

05
review_pending

Review pending

Versioned policy places the immutable result in an uncertainty, sensitive-class, or mandatory-sampling review lane.

06
acceptedterminal

Accepted

An independent reviewer accepted the derived evidence for the declared purpose and exact policy/model/output versions.

07
rejectedterminal

Rejected

An independent reviewer rejected the result with an attributable reason while retaining the immutable provider evidence.

08
redactedterminal

Redacted

Derived labels and geometry were removed at the retention deadline while the minimum decision, hashes, policy, and audit record remain.

Command → decision → event

Transitions are attributable and retry-safe

Commands express intent. The aggregate validates current state and invariants, commits one new version, and emits a fact in the same transaction.

Command & actorAllowed fromResultIdempotency strategy
register_caseAsset steward
new aggregate
registeredvision.case_registered

One external reference and asset hash map to one case across retries.

lock_modelVision worker
registered
model_lockedvision.model_locked

Server reference, model key, metadata fingerprint, and policy version identify one lock.

request_inferenceVision worker
model_locked
inference_requestedvision.inference_requested

One attempt identity binds the case version, asset hash, model fingerprint, and request policy.

record_inferenceVision worker
inference_requested
inferredvision.inference_recorded

Provider status and response hash close one active attempt exactly once.

submit_reviewPolicy service
inferred
review_pendingvision.review_requested

Thresholds, reason codes, policy version, and attempt identity create one immutable review request.

acceptIndependent reviewer
review_pending
acceptedvision.accepted

Reviewer, reason, policy, attempt, and expected aggregate version identify the terminal decision.

rejectIndependent reviewer
review_pending
rejectedvision.rejected

Reviewer, reason, policy, attempt, and expected aggregate version identify the terminal decision.

redactPrivacy worker
inferredreview_pendingacceptedrejected
redactedvision.redacted

One retention action removes derived detail while preserving the minimum integrity and audit record.

Durable records

Persist enough to recover and explain

Keep provider responses, business identity, state, events, and side-effect delivery distinct so each can be reconciled safely.

Vision case

Business purpose, external identity, lifecycle, policy, retention, and optimistic version.

caseIdexternalIdpurposestateversionpolicyVersionretentionUntil

Asset envelope

Opaque, non-media identity and integrity facts for one captured source.

assetRefsha256mediaClasswidthheightcapturedAtlawfulBasisRef

Model lock

Exact entitled discovery evidence and immutable model selection.

serverRefapiModelKeymodelFingerprintclasseslockedAt

Inference attempt

Synchronous request lifecycle, normalized response, safe failure, timing, and provenance.

attemptIdassetHashmodelFingerprintstatusresultHashregionstimings

Review and retention

Policy reasoning, attributable disposition, and derived-detail redaction evidence.

reviewIdreasonCodesreviewerdecisionredactedAt

Audit and outbox

Append-only state evidence and exactly-once-in-effect downstream notification.

eventIdaggregateVersionidempotencyKeyactoroutboxStatus
Non-negotiable rules

Protect truth at the aggregate boundary

  1. 1

    No image bytes, media URL, bearer token, credential, face, number plate, or provider-internal file path enters the reference case store.

  2. 2

    The provider POST /predict call is synchronous; application queue, review, retry, decision, and retention states are never attributed to SkyDNN.

  3. 3

    Every attempt binds an immutable asset hash to one discovered model fingerprint and policy version.

  4. 4

    Confidence and geometry are evidence, not a business outcome or live safety command.

  5. 5

    Reviewer identity is independent from the fixture inference actor and every override or rejection has a reason.

  6. 6

    Idempotency, optimistic versions, audit, receipts, and outbox commit atomically.

Failure and recovery

Know what to do before it breaks

Recovery changes durable truth only through the same rules as normal operation. A timeout is an unknown outcome, not evidence that nothing happened.

Model discovery changes after the case is prepared

Detect

Current metadata fingerprint differs from the locked fingerprint.

Recover

Stop, create a new model lock and attempt, and retain the original lock for comparison.

Provider response is lost after a synchronous request

Detect

The active attempt has no terminal response hash and transport outcome is ambiguous.

Recover

Reconcile with the approved provider boundary when possible or record a safe failed attempt before a deliberate linked retry.

Geometry, label, or confidence is malformed

Detect

Schema, bounds, topology, vocabulary, or numeric validation fails.

Recover

Quarantine derived detail, retain a safe error class, and do not send it to policy or review.

Sensitive or uncertain inference reaches policy

Detect

A privacy class, low confidence, unsupported label, or mandatory sample rule matches.

Recover

Require independent review and prevent automation from issuing a terminal business or safety action.

Retention deadline passes while review is open

Detect

Derived output remains present after the committed policy deadline.

Recover

Redact on schedule, close or fail the review with explicit expiry, and retain minimum audit evidence.

Process restarts after a command timeout

Detect

The client lacks acknowledgement while snapshot, receipt, audit, and outbox are durable.

Recover

Reload and replay the same idempotency key without duplicating attempts, decisions, or events.

Operational telemetry

Observe the journey, not merely HTTP status

Measure state age, event health, retries, reconciliation, and sensitive-data access alongside latency and error rate.

  • Cases by state, purpose, media class, model fingerprint, and policy version
  • Model discovery drift, lock age, and incompatible input rate
  • Inference latency, safe error class, result-schema rejection, and ambiguous outcome
  • Confidence, label, geometry type, and review-reason distributions
  • Review queue age, disposition, override, disagreement, and sampling coverage
  • Sensitive-class access and derived-output retention/redaction deadlines
  • Idempotency replay, version conflict, restart recovery, audit, and outbox age
Grounded implementation

Contracts, repositories, workshops, tutorials, and runnable evidence

Only explicitly indexed evidence is linked. Empty sections are not backfilled with invented endpoints or package names.